Iranian state-backed threat actors have escalated cyberattacks against U.S. critical infrastructure, specifically targeting internet-exposed programmable logic controllers (PLCs) manufactured by Rockwell Automation (Allen-Bradley devices) since March 2026, according to a joint U.S. federal advisory. These attacks have led to operational disruptions and financial losses, with observed activity including the extraction of PLC project files and manipulation of HMI and SCADA systems. Research from Censys identified over 5,200 exposed PLC devices globally, with approximately 74.6% (3,891) located in the United States. Many of them are deployed in the field via cellular networks, increasing their exposure risk. The campaign reflects broader geopolitical tensions involving Iran, the United States, and Israel, and follows prior Iranian-linked operations such as CyberAv3ngers targeting Unitronics PLCs in U.S. water infrastructure (impacting at least 75 devices between late 2023 and early 2024), as well as destructive activity by the Handala group, which reportedly wiped 80,000 devices at medical firm Stryker. Authorities recommend immediate mitigation measures including removing PLCs from direct internet exposure, implementing firewalls and MFA for OT environments, monitoring logs, and OT network traffic, and ensuring systems are fully patched and unnecessary services disabled to reduce attack surface. CTIX analysts urge all critical infrastructure security personnel to ensure that they are following the guidance and hardening their security posture.